1. How to read this register
This page records the principal technology providers that may process personal data for Royal Baltic or act as an independent controller for a defined function. A provider is not authorised to receive data merely because it appears in this list: the relevant feature must also be configured and, where required, the user must have consented.
2. Current / approved providers
| Provider | Purpose / data | Location / transfer | Contractual instrument |
|---|---|---|---|
| IONOS SE | Domain registration and company email mailboxes under Royal Baltic domains. | Germany / EEA for the contracted Royal Baltic domain and mail services. IONOS subprocessors may be used according to the contracted product and AVV. | IONOS AVV / GDPR information. Royal Baltic's IONOS account confirms the Data Processing Agreement (DPA/AVV) as completed on 22 September 2026. IONOS also states that the DPA has been part of its Terms and Conditions since 19 July 2022. The agreement applies to the contracted IONOS processing services, including the relevant webhosting and mail products. |
| Supabase, Inc. | Postgres database, authentication and storage. Royal Baltic's primary project is configured in eu-west-1 (Ireland). | Primary project region EU; approved Supabase subprocessors may operate internationally. | Supabase DPA and incorporated transfer clauses / subprocessor terms. |
| Vercel Inc. | Hosting the rb-z-code.vercel.app application, development/preview deployments, build tooling, edge delivery and operational logs. This does not assert that royal-baltic.eu is already serving this application. | Global infrastructure; transfers outside EEA may occur when Vercel environments are used. | Vercel DPA, including EU SCC transfer provisions where applicable. |
| Resend / Plus Five Five, Inc. | Transactional email such as sign-in, B2B status and order/service notifications. | United States and listed subprocessors; international transfers may occur. | Resend DPA; EU SCCs and, where applicable, EU-U.S. Data Privacy Framework. Subprocessors. |
| Stripe | Card payments, invoicing and tax functionality when activated; payment and transaction information. | Stripe European contracting entity and global Stripe infrastructure/affiliates depending on service. | Stripe DPA and Data Transfers Addendum / applicable transfer mechanisms. |
| DeepL SE — API Free | Translation of non-personal editorial/admin content only. Royal Baltic policy prohibits sending customer, contact, account, order, invoice or other personal data to the current DeepL API Free integration. | DeepL SE is based in Germany, but DeepL's current infrastructure is not represented here as EU-only. Processing locations and subprocessors may change with the service and plan. | The current API Free integration is not treated as covered by a Royal Baltic processor DPA for personal-data translation. If personal data must ever be translated, Royal Baltic must first move to an appropriate paid DeepL Pro/API Pro service, execute/retain the applicable DPA and review transfer/subprocessor terms. See DeepL Privacy Policy and DeepL data security. |
| Optional Google sign-in when initiated by the user; Analytics and Ads only when separately configured and consented. | EEA and global Google locations; some transfers may involve the United States. | Google Controller-Controller Data Protection Terms and applicable SCC / transfer solutions. |
3. Klaro is not a remote subprocessor
Royal Baltic vendors the open-source Klaro consent code into its own application and serves it from the Royal Baltic domain. Klaro therefore does not receive consent data as a hosted CMP provider and creates no vendor account or monthly processor dependency.
4. International transfer safeguards
Where a provider processes EEA personal data in a country without an applicable adequacy decision, Royal Baltic requires the contractual transfer mechanism provided for the relevant service, typically the European Commission's Standard Contractual Clauses and any supplementary technical/organisational safeguards. Where a provider validly relies on the EU-U.S. Data Privacy Framework for a covered transfer, that framework may also be used as the transfer mechanism.
The fact that a provider's headquarters are outside the EEA does not mean that all Royal Baltic data is stored there. Conversely, an EU primary database region does not guarantee that every support, security, email, payment or subprocessor operation stays within the EEA.
5. DPA control procedure
Before a production service that processes personal data is enabled, Royal Baltic should ensure that the provider account is contracted in the company name where supported, retain or link the then-current DPA, review the provider's subprocessor list and record any material international-transfer mechanism. Provider terms are versioned externally and must be rechecked when a service, plan, processing purpose or data location changes.
6. Changes to this list
Royal Baltic will update this register when a material processor is added or replaced. Adding a new analytics, advertising, external-video, map or support service also requires classification in the Privacy Service Registry so that it cannot bypass the user's consent choice.